Subject: RE: [mobile-ip] Protecting the MN-HA signaling with IPsec

From: [email-masked]
Date: Thu, 26 Sep 2002 14:33:38 +0300

Jari Arkko wrote:
> 
> I'm also beginning to think the use of IPsec for this was tougher
> than expected. However, I'm not sure we have any easy alternative
> either. MH authenticator option does not offer protection for HOTI/HOT
> for instance.
> 

How about using MH Authenticator for MN-HA MH protection (MUST) and ESP for MN-HA tunnel protection (SHOULD?).  BU packet sending/receiving would be simplified, as e.g. the new CoA could be the source address of the BU packet, with no additional IPv6 options:

        IPv6 header (source = care-of address, destination = home agent)
        Mobility header
           Binding Update
              Home Address (home address)
              Alternate Care-of Address (care-of address)
              Authenticator (...)

Preferably ALL MIPv6 features would be folded in the Mobility Header (i.e. MPS/MPA/HAAD also in MH), and thus protected by the same MH Authenticator.

	Jarno

---

From: Francis Dupont <[email-masked]>
Date: Thu, 26 Sep 2002 14:54:35 +0200

How about using MH Authenticator for MN-HA MH protection (MUST) and

=> how do you build the shared secret between the MN and the HA?
The best way is to reuse something with IKE, so why not the real IPsec??

   ESP for MN-HA tunnel protection (SHOULD?).

=> MUST (or forget security). So you have to play with IPsec.

   BU packet sending/receiving would be simplified, as

=> there is no real interest to simplify it. The current spec works
as soon as there is a SA pair, what you propose is dedicated security
stuff which is always harder to implement (new code) and to make really
secure.

   Preferably ALL MIPv6 features would be folded in the Mobility
   Header (i.e. MPS/MPA/HAAD also in MH), and thus protected by the same
   MH Authenticator.
   
=> IMHO some of these features should be dropped...
And there is a strong opinion here (initiated by Jari T. Malinen and
shared by all of us at the IPv6 ETSI plugtest) that the protection
by IPsec MUST be supported (note that support != use).
The MH Authenticator is not the issue: the problem is how the shared
secret is safely built.

Regards

[email-masked]

---

From: Michael Thomas <[email-masked]>
Date: Mon, 30 Sep 2002 12:32:38 -0700 (PDT)

> How about using MH Authenticator for MN-HA MH protection (MUST) and
ESP for MN-HA tunnel protection (SHOULD?).  BU packet
sending/receiving would be simplified, as e.g. the new CoA could be
the source address of the BU packet, with no additional IPv6 options:

   The problem here is that you have no way to key those
   SA's which is a problem. Using off the shelf keying (eg,
   IKE, KINK...) is a big advantage as getting keying
   to some semblance of correct has historically been,
   shall we say, a challenge.

	    Mike